Skip to main content

no-full-access-without-approval

Disallow Codex configuration that combines unrestricted execution with no approval prompts.

Rule catalog ID: R008

Targeted pattern scope​

  • **/.codex/config.toml
  • standalone *.config.toml profiles where applicable

What this rule reports​

  • danger-full-access with approval_policy = "never" removes both sandbox and approval boundaries. Use a tighter sandbox or an approval policy unless this risk is explicitly required.

Why this rule exists​

Disallow Codex configuration that combines unrestricted execution with no approval prompts.

❌ Incorrect​

A file in the targeted scope that produces any diagnostic listed above is incorrect for this rule.

✅ Correct​

A file is correct when it uses the documented Codex structure and produces no diagnostic from this rule.

Behavior and migration notes​

Included in:

  • codex.configs.strict
  • codex.configs.all

ESLint flat config example​

The preset layers supply the correct Markdown, TOML, or JSON language configuration. Override the rule only in a later matching flat-config entry:

import codex from "@typpi/eslint-plugin-codex";

export default [
 ...codex.configs.recommended,
 {
  rules: { "codex/no-full-access-without-approval": "error" },
 },
];

Further reading​